Database Security DAC MAC Application Servers Web Encryption Users/Roles Stored Procedures, Views

DAC In a Database (RDBMS) we limit access to tables via columns. Table Person Columnsa, b, c Grant select, insert, update, delete on Person.a to Dan; Column wise security

DAC (Continue) Table Person Columns a b c Grant select on Person to Dan; This will mean that Dan may see all rows in Person

DAC (Concluded) Statements CREATE TABLE, CREATE VIEW, CREATE USER, CREATE PROCEDURE We give direct or indirect access to these commands GRANT CREATE TABLE to DAN;

DAC - Auditing Auditing is done in a vendor specific way. So we have a way of specifying auditing on a Table/Column to a User. Vendors do this by writing to a table --- their version of an audit log.

Access Control Database Vendors take on the perspective that they control all users. Every user of the system - is a database user. What is wrong with this? May not be be encrypted the creation of users. Millions users on Amazon, every database had to install a user..... how well would the database work. In other words, would we have to create 10,000,000 users in ORACLE.

Access Control There are no standard commands to create users. So the software would have to know if the backing database was MySQL or ORACLE, or, etc. If your users were create by admin screen, they code is no longer write once run anywhere. So you end up with your own Users, Roles, etc. tables. But this is not bad because the standards we covered only limit columns.

Access Control GRANT SELECT on Person.a to Dan But what if Dan can only see Dan records and the records of people he manages but cannot see anyone else. This is on a per row basis. So how do you do this?

Views REVOKE SELECT on Person from Public; Create view My_VIEW as SELECT * FROM Person where Person.name = username (); GRANT SELECT on My_VIEW to Public; // Dan sees Dan's records only SELECT * from My_VIEW;

The Previous Slide was Bad Why... Because it assumes that Dan is a database user. We cannot make that assumption. So what do we do? We have, say a web application, and it has access to the database. That web app gets a connection and we manage the data by labeling. The web tier accesses the database by one and only one user. Therefore the web tier has to help.

How It Works Tomcat MySQL Tomcat User This means that the Tomcat server gets a username and password and All tomcat users run as the same user. So how do we do access control?

Real World Access Control Do not use Grant/Revoke Use Labeling Tables Person Table We label the attributes or the Row itself Person A, b, c Top Secret, Secret Tomcat access Java Code Adjudicates Normal Database User – Say the name of your app.

Why Databases have very few standards. We have CREATE TABLE, SELECT, INSERT, UPDATE and DELETE as standard commands.... That is pretty well it. We do not want our code to violate the write once run anywhere paradigm. So we manage the labels ourselves. This is a specification compliant manner for database access.

What about Confidentiality? Nothing.... Typically the web server will work with https which is encrypted. The link between the web server and the database is private... Therefore is there any need to encrypt? No.

Real World Confidentiality Tables Person Table We label the attributes or the Row itself Person A, b, c Top Secret, Secret Tomcat access Java Code Adjudicates Normal Database User Uses a non http port https IP Address 192. or

Best Practices with Standards Web Tier Database Homogeneous User Is open for SELECT, INSERT, UPDATE and DELETE from the Web Tier User Adjudication and Auditing goes on at this level what we call the middleware tier.

What is Wrong with This? Web Tier Database Homogeneous User Is open for SELECT, INSERT, UPDATE and DELETE from the Web Tier User Adjudication and Auditing goes on at this level what we call the middleware tier. Another App You must add Adjudication rules. They are not stored with the data.

Proprietary Solution - ORACLE What is advantage? The labeling or adjudication rules are attached to the data. You cannot get the data without adjudication. Web Tier Database JDBC Named Connection per user ORACE OLS Database does All adjudication and auditing Handing off user to database. Telling database what user

Standards vs. Proprietary Standards give us no vendor lock in. Frequently standards give us “free” solutions. They however, may be compromises and may have some limitations. They do, alternately, guarantee, no single source solution. Standards typically delineate responsibility – ie. ORACLE may not need to provide confidentiality.